Ops checklist: Plausible dashboard actions, Search Console API, PageSpeed key

[MarkusNeusinger]

Manual/console actions from the 2026-07-08 audit that no PR can ship — mostly maintainer dashboard work:

Plausible dashboard (completes #9625's repo-side bot shield — High#7 second half):

• Country exclusions or IP/ASN block rules for the residual synthetic traffic (CN/RU headless waves); filter CN/RU when reading historical trends
• Register the framework custom property so library_filter breakdowns become visible (Low#12)
• Decide the outbound-click double-tracking (Low#13): auto "Outbound Link: Click" (33/30d) overlaps custom external_link (12/30d) — pick one, document the survivor in docs/reference/plausible.md
• After fix: analytics hygiene — bot shield, /plots pageviews, doc sync #9625 deploys: expect the visitor count to drop to human baseline — annotate the trend break

Google Search Console (Medium#17 second half):

• Provision webmasters.readonly scope for the audit tooling so index-coverage becomes auditable (the synthetic bot monitor half shipped in fix: crawlers get 502 on every page — raise proxy_ssl_verify_depth + add synthetic bot monitor #9617/fix: bot-serving monitor must target the Cloud Run origin (Cloudflare 403s runner IPs) #9619)

PageSpeed Insights (Medium#9 / Low#9):

• Provision a free GCP API key with the PSI API enabled → repo secret PAGESPEED_API_KEY; lab metrics have been blocked for 5 consecutive audits on anonymous quota
• Rewrite agentic/commands/audit/pagespeed-auditor.md: its auth contract is factually wrong ("works without a key … plenty" — failed 5/5 runs on 429); key required in practice, probe once, fail fast to blocked

Web Vitals follow-up (Medium#21):

• Re-measure field TTFB/LCP after the bot filter lands — raw dashboard numbers were bot-skewed ~3× worse; TTFB is the lever (Cloud Run region/cold starts, edge caching)

Audit: agentic/audits/2026-07-08-product-ux.md.